An IT steering committee wants to select a disaster recovery site based on available risk data. Which of the following would BEST enable the mapping of cost to risk?

Key risk indicators (KRIs) measure the likelihood or potential severity of risks, but do not directly map cost to risk impact for recovery planning.

Scenario-based assessment evaluates specific hypothetical events but doesn't inherently provide the comprehensive cost-to-risk mapping for recovery planning that a BIA does.

A Business Impact Analysis (BIA) identifies critical business functions and systems and quantifies the financial and operational impact of disruptions, allowing for the mapping of potential costs of recovery solutions (like a DR site) against the identified risks and their associated impacts.

Qualitative forecasting estimates future outcomes based on non-numerical data and is less precise for mapping specific costs to risks than a BIA.